Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python3", pid 1682, jiffies 4295346908 (age 24.090s) backtrace: kmalloc_trace device_add device_private_init at drivers/base/core.c:3361 (inlined by) device_add at drivers/base/core.c:3411 cdev_device_add gpiolib_cdev_register gpiochip_setup_dev gpiochip_add_data_with_key gcdev_register() & gcdev_unregister() would call device_add() & device_del() (no matter CONFIG_GPIO_CDEV is enabled or not) to register/unregister device. However, if device_add() succeeds, some resource (like struct device_private allocated by device_private_init()) is not released by device_del(). Therefore, after device_add() succeeds by gcdev_register(), it needs to call put_device() to release resource in the error handle path. Here we move forward the register of release function, and let it release every piece of resource by put_device() instead of kfree(). While at it, fix another subtle issue, i.e. when gc->ngpio is equal to 0, we still call kcalloc() and, in case of further error, kfree() on the ZERO_PTR pointer, which is not NULL. It's not a bug per se, but rather waste of the resources and potentially wrong expectation about contents of the gdev->descs variable.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 159f3cd92f17c61a4e2a47456de5865b114ef88e before 6daaa84b621485fe28c401be18debf92ae8ef04a; affected 159f3cd92f17c61a4e2a47456de5865b114ef88e before 371363716398ed718e389bea8c5e9843a79dde4e; affected 159f3cd92f17c61a4e2a47456de5865b114ef88e before ec851b23084b3a0af8bf0f5e51d33a8d678bdc49 |
| Linux / Linux | affected 4.6; unaffected 0 before 4.6; unaffected 5.15.83 through 5.15.*; unaffected 6.0.13 through 6.0.*; unaffected 6.1 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/6daaa84b621485fe28c401be18debf92ae8ef04a
- https://git.kernel.org/stable/c/371363716398ed718e389bea8c5e9843a79dde4e
- https://git.kernel.org/stable/c/ec851b23084b3a0af8bf0f5e51d33a8d678bdc49
ADP enrichment
No English description supplied.
No references supplied.